What is the CVSS score of CVE-2026-44864?

CVE-2026-44864 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Aruba Networking AOS are affected by CVE-2026-44864?

HPE Aruba Networking Wireless OS (AOS-8 and AOS-10) contains a SQL injection vulnerability in the CLI and management protocol that permits authenticated administrators to execute arbitrary commands…

How to fix or mitigate CVE-2026-44864?

Within 24 hours: Inventory all HPE Aruba AOS-8 and AOS-10 devices running versions 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x, or 10.8.0.0; immediately restrict administrator account access to wireless controllers to named staff only and enable multi-factor authentication for all administrative sessions. Within 7 days: Contact HPE Support to obtain patch availability timeline and upgrade recommendations; implement network segmentation to isolate wireless controllers from sensitive systems; enable and centralize detailed CLI command logging. Within 30 days: Test and stage available HPE patches in non-production environment; evaluate upgrade feasibility to newer AOS versions; document compensating controls in security assessments.

Aruba Networking AOS CVE-2026-44864

EUVD-2026-29814 HIGH

SQL Injection (CWE-89)

2026-05-12 hpe

GHSA-9xv7-mm2m-gv6c

SQLi Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management interface (AV:N) but requires existing admin privileges (PR:H); SQLi-to-OS-command-execution yields total CIA impact on the same appliance (S:U, C/I/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:51 vuln.today

CVE Published

May 12, 2026 - 19:11 nvd

HIGH 7.2

DescriptionCVE.org

SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.

AnalysisAI

SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator inject crafted input into backend database queries reachable through the CLI and management protocol, ultimately achieving arbitrary command execution on the underlying OS of the wireless controller/gateway. Multiple 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x and 10.8.0.0 releases are affected. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with the SSVC 'Exploitation: none' finding.

Technical ContextAI

The affected technology is HPE Aruba Networking's Wireless Operating System (AOS), the firmware running on Aruba Mobility Controllers/Conductors and gateways, exposed via its command-line interface and a management protocol front-end. Per the vendor, several underlying service components pass operator-supplied parameters unsanitized into backend SQL database queries, the classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) root cause. Because these service components run with high OS privilege, injected SQL is leveraged to break out into OS command execution rather than merely reading or tampering with database rows. The affected CPE is cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos):*, i.e. the AOS software platform itself rather than a specific appliance model.

RemediationAI

Apply the fixed AOS releases published in HPE advisory hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US) - upgrade beyond each affected ceiling in your train (i.e. later than 8.10.0.21, 8.12.0.6, 8.13.1.1, 10.4.1.10, 10.7.2.2, and off 10.8.0.0). Exact fixed build numbers should be taken directly from the HPE bulletin, as they are not independently confirmed in the input data (Patch available per vendor advisory). Because exploitation requires administrative access, the strongest compensating control until patching is to restrict and harden management-plane access: place the CLI and management protocol interfaces on a dedicated out-of-band management VLAN, enforce ACLs so only trusted admin hosts can reach them (trade-off: legitimate remote admin must route through that path), enforce strong/MFA-backed admin authentication and unique per-admin accounts, and closely audit admin CLI activity to detect abuse. Follow the principle of least privilege for administrator accounts to shrink the pool of identities that could trigger the flaw.